版本发布 8
* Add function for scanning files by path to the C and Go APIs (32bac10). * Add version number to the Rust API (bdb53e8, #469). * Add `osabi` field to `elf` module (afa0960). * Avoid verifying patterns when the file size is not in the range specified in the rule condition (#473). * Avoid emitting code that invokes `search_for_patterns` if not necessary (#487). * Implement DFS iterator for expressions in AST (#488). * BUGFIX: Check if `AddressOfFunctions` is zero while parsing PE files (#482). Contributors: @vojone
BUGFIX: fix compilation in 32-bits platforms (#453).
* New warning suggesting the use of `none of them` instead of `0 of them`. * Added option `--max-matches-per-pattern` to the CLI and the `max_matches_per_pattern` method to the Python API (#437). * New `yrx_finalize` function to the C API that allows dynamically unloading the YARA-X library (#445). * Add `yrx_compiler_add_include_dir` function to the C API (#447). * Replace the `Formatter::ident_spaces` method with `Formatter::indentation` (b8a1808). * BUGFIX: Indentation issues in code formatter (6bfe2e2). * BUGFIX: Inconsistencies in code formatter with empty lines at the end of the code (de10bbd). * BUGFIX: High memory consumption while parsing some PE files (af18dbc, #443) * BUGFIX: Prevent panic when assertions like `\b` and `\B` are used in Unicode regexps (0536ad1). Contributors: @1ndahous3 @jtpox @vojone
* Allow suppressing warnings using `// suppress: warning_id` comments (#398). * Implement built-in functions `float32`, `float64`, `float32be` and `float64be` (#396). * BUGFIX: fix wrong `text_as_hex` warning (0baf08b, #397). * BUGFIX: false positive in wide regular expressions (5fd5015, #395)
* Add the `yrx_scanner_set_module_data` function to the C API. * Show warnings when comparing the result of `intXX` and `uintXX` functions with values outside their valid ranges. Example: ``` warning[unsatisfiable_expr]: unsatisfiable expression --> demo.yar:6:3 | 6 | uint8(0) == 0x1FF | -------- ----- this integer is outside the range [0,255] | | | this expression is an integer in the range [0,255] | ``` * BUGFIX: Less strict schema for Cuckoo reports (#369). * BUGFIX: CLI reports UTF-8 encoding errors instead of ignoring them silently (2372d68) (thanks to @craiu for the report) * BUGFIX: Fix issue in the Python API while parsing JSON data (#365, c3ad3ac). Contributors: @vojone @szabgab
* BUGFIX: Panic while truncating long file paths containing Unicode characters (#360). * BUGFIX: JSONDecodeError in Python API (#361).
* Implement [include](https://virustotal.github.io/yara-x/docs/writing_rules/including-files/) statements (#350). * Add module invoke support to Python API (#348). * BUGFIX: Parsing aborted when too many rules had the `global` or `private` modifiers (d9a1f97). Contributors: @wxsBSD
* Parse LC_DYLD_EXPORTS_TRIE in Mach-O files (#303). * Parse chained fixup imports via LC_DYLD_CHAINED_FIXUPS in Mach-O files (#305). * Implement tag linter (#304). * Implement regex anchors `^` and `$` in multi-line mode (8b01882). * Add support for 32-bits targets. * Improve performance by memoizing some function calls (#311). * Open source the `vt` module. * BUGFIX: Do not abort parsing when .NET file has a table with more than MAX_ROWS_PER_TABLE (908009b). * BUGFIX: Prevent infinite loop due to cycles in certificate chain (a751199). Contributors: @latonis, @wxsBSD, @JonathanAnbary